Keepalived
Keepalived在这里主要用作RealServer的健康状态检查以及LoadBalance主机和BackUP主机之间failover的实现 。IPVS通常与keepalived配合使用,后者也是LVS项目的子项目之一,用于检测服务器的状态。
在lvs体系中,Keepalived主要有如下3个功能:
1 管理LVS负载均衡软件
2 实现对LVS集群节点的健康检查功能
3 作为系统网络服务的高可用功能
即 Keepalived 实现了 heartbeat + ldirectord 的功能
原理
Layer3,4,5工作在IP/TCP协议栈的IP层,TCP层,及应用层,原理分别如下:
Keepalived使用Layer3的方式工作式时,Keepalived会定期向服务器群中的服务器发送一个ICMP的数据包(既我们平时用的Ping程序),如果发现某台服务的IP地址没有激活,Keepalived便报告这台服务器失效,并将它从服务器群中剔除,这种情况的典型例子是某台服务器被非法关机。Layer3的方式是以服务器的IP地址是否有效作为服务器工作正常与否的标准。
实验三:高可用集群High-Avaliability
实验环境:
server1:MASTER机
server4:BACKUP机
server2:Real server机1
server3:Real server机2
配置步骤
1、用server1做lvs负载均衡的DR模式
[root@server1 ~]# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 52:54:00:c4:21:a9 brd ff:ff:ff:ff:ff:ff
inet 172.25.29.1/24 brd 172.25.29.255 scope global eth0
inet 172.25.254.100/24 scope global eth0
inet6 fe80::5054:ff:fec4:21a9/64 scope link
valid_lft forever preferred_lft forever
[root@server1 ~]# ipvsadm -A -t 172.25.254.100:80 -s rr
[root@server1 ~]# ipvsadm -a -t 172.25.254.100:80 -r 172.25.29.2:80 -g
[root@server1 ~]# ipvsadm -a -t 172.25.254.100:80 -r 172.25.29.3:80 -g
[root@server1 ~]# ipvsadm -L
IP Virtual Server version 1.2.1 (size=4096)
Prot LocalAddress:Port Scheduler Flags
-> RemoteAddress:Port Forward Weight ActiveConn InActConn
TCP 172.25.254.100:http rr
-> server2:http Route 1 0 0
-> server3:http Route 1 0 0
[root@server1 ~]#
2、server2和server3做Read server配置
[root@server2 ~]# ip addr
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 16436 qdisc noqueue state UNKNOWN
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP qlen 1000
link/ether 52:54:00:50:62:94 brd ff:ff:ff:ff:ff:ff
inet 172.25.29.2/24 brd 172.25.29.255 scope global eth0
inet 172.25.254.100/32 scope global eth0
inet6 fe80::5054:ff:fe50:6294/64 scope link
valid_lft forever preferred_lft forever
[root@server2 ~]# arptables -A IN -d 172.25.254.100 -j DROP
[root@server2 ~]# arptables -A OUT -s 172.25.254.100 -j mangle-ip-s 172.25.29.2
Bad argument `172.25.29.2'
Try `arptables -h' or 'arptables --help' for more information.
[root@server2 ~]# arptables -A OUT -s 172.25.254.100 -j mangle --mangle-ip-s 172.25.29.2
[root@server2 ~]# arptavles -L
-bash: arptavles: command not found
[root@server2 ~]# arptables -L
Chain IN (policy ACCEPT)
target source-ip destination-ip source-hw destination-hw hlen op hrd pro
DROP anywhere 172.25.254.100 anywhere anywhere any any any any
DROP anywhere 172.25.254.100 anywhere anywhere any any any any
Chain OUT (policy ACCEPT)
target source-ip destination-ip source-hw destination-hw hlen op hrd pro
mangle 172.25.254.100 anywhere anywhere anywhere any any any any --mangle-ip-s server2
mangle 172.25.254.100 anywhere anywhere anywhere any any any any --mangle-ip-s server2
Chain FORWARD (policy ACCEPT)
target source-ip destination-ip source-hw destination-hw hlen op hrd pro
[root@server2 ~]#
[root@server2 ~]# /etc/init.d/arptables_jf save
Saving current rules to /etc/sysconfig/arptables: [ OK ]
[root@server2 ~]#
server1配置(先删掉之前做DR模式给它指定的vip,因为keepalived配置文件会自动分配vip)
1、下载keepalived软件包
注意:compile报错时,解决依赖性, 安装 openssl-devel
[root@server1 ~]# yum install openssl-devel.x86_64 -y
3、配置keepalived服务
/etc/keepalived/keepalived.conf
global_defs {
notification_email {
root@localhost
}
notification_email_from keepalived@localhost
smtp_server 127.0.0.1
smtp_connect_timeout 30
router_id LVS_DEVEL
vrrp_skip_check_adv_addr
#vrrp_strict
vrrp_garp_interval 0
vrrp_gna_interval 0
}
vrrp_instance VI_1 {
state MASTER
interface eth0
virtual_router_id 29
priority 100
advert_int 1
authentication {
auth_type PASS
auth_pass 1111
}
virtual_ipaddress {
172.25.254.100
}
}
virtual_server 172.25.254.100 80 {
delay_loop 3
lb_algo rr
lb_kind DR
#persistence_timeout 50
protocol TCP
real_server 172.25.29.2 80 {
weight 1
SSL_GET {
connect_timeout 3
retry 3
delay_before_retry 3
}
}
real_server 172.25.29.3 80 {
weight 1
SSL_GET {
connect_timeout 3
retry 3
delay_before_retry 3
}
}
}
server4
在server4上安装gcc ipvsadm openssl-devel等依赖包
[root@server4 ~]# yum install ipvsadm gcc openssl-devel httpd -y
1、将server1中的/usr/local/keepalived目录直接复制到server4中
[root@server1 keepalived]# scp -r /usr/local/keepalived/ server4:/usr/local/
2、在server4中创建软链接并给server4加入ipvsadm策略
3、将server1中的配置文件复制到server4中
[root@server1 keepalived]# scp /etc/keepalived/keepalived.conf server4:/etc/keepalived/
root@server4's password:
keepalived.conf 100% 1055 1.0KB/s 00:00
[root@server1 keepalived]#
4、修改server4配置文件
server4配置文件和server1差不多,只需要改两行即可
server1和server4配置成功
1、开启server1和server4的keepalived
测试:
配置成功后,我们用物理机访问vip,访问结果为server2和server3轮询,且arp指向server1的物理地址,当server1的kp关闭后,物理机访问,轮询依旧正常,不过arp指向了server4的物理地址,所以说在主机出现故障时,备机能迅速代替工作,当server1开启kp后,物理机访问arp指向server1的物理地址,则表示当主机恢复正常后,主机会马上接管vip,从而实现双机热备高可用